By way of example but not limited to: forename, surname, date and place of birth, residence,e-mail address, telephone numbers, fiscal code/VAT number, job, etc.

IDENTITY MANAGEMENT SYSTEM

The Company has implemented an Identity Management system that allows registered users to access all Gewiss websites / services / apps (hereafter, "Services"), regardless of the device used, by entering their authentication credentials. Therefore, after registering with one of the aforementioned Services, users will be able to access one of the others (subject to acceptance of the relevant contractual conditions), through their credentials (e-mail address and password) without performing a new access.

DATA PROCESSING PURPOSES

LEGAL BASIS FOR PROCESSING DATA

DATA RETENTION PERIOD

Purposes related to website subscription and to use the services etc.

Execution of the contract involving the data subject.

Duration of the contract and after completion, 10 years. For the duration of any legal disputes until completion of the terms of implementation outlined in legal remedies.

To fulfil regulatory and legal obligations as foreseen by applicable national and international laws.

Necessity to fulfil an obligation imposed by law.

If necessary to ascertain, exercise and/or safeguard Company rights in legal proceedings.

Legitimate interest.

Out-of-court debt recovery.

Legitimate interest.

Control of logical access to company information systems, in order to guarantee the safety of people and property.

Once the aforementioned retention period has lapsed data will be destroyed or made anonymous compatibly with technical erasure and backup procedures.

COMPULSORINESS OF DATA PROVISION

Data marked with an asterisk (*) in the data collection form must be provided to be able to put in place and execute the contract; therefore any refusal to provide such data will block the website/ services / app.

DATA RECIPIENTS

In addition to the Subsidiaries of Gewiss S.p.A, data may be communicated to parties acting as external data processor such as e.g. supervisory and regulatory authorities and, more generally, public or private entities, legally authorised to requests data. Data may be as well processed, on Company’s behalf, by external entities appointed as processors, who are provided with suitable operating instructions. These parties include the following categories:

Email marketing companies;

Website maintenance companies;

Companies that provide support for market analysis.

PARTIES AUTHORISED TO PROCESS DATA

Data may be processed by employees in company departments who are responsible for carrying out the activities outlined above and have been authorised to process the data and have received suitable operating instructions.

DATA SUBJECTS’ RIGHTS – COMPLAINT TO THE SUPERVISORY AUTHORITY

By contacting Gewiss S.p.A. via e-mail sent to privacy@gewiss.com, data subjects can ask thecontroller for access to personal data, or the correction or deletion of personal data, and alsohave the right to restrict processing of the data in the cases set out in article 18 GDPR, andobject to processing in the case of legitimate interests of the controller.

Furthermore, in the case where processing is based on consent or a contract and carried outwith automated tools, data subjects have the right to receive the personal data in a structured,commonly used and machine-readable format, and to transmit the data to another data controller without obstruction.

Data subjects have the right to withdraw theirs consents at any time expressed for themarketing, furthermore to object the processing for the marketing purpose including the profiling linked with direct marketing. It is understood that data subjects who prefer to get contacted for the above mentioned purpose through traditional forms of communications, to express their objections to automated communications only.

Data subjects have the right to lodge a complaint to the competent Supervisory Authority in themember state where they are resident or where they work, or the member state where the alleged breach took place.